A Blank Password Field and a Relay Trap: What the ScreenConnect SCKit Attack Actually Teaches
On November 11, 2026, at 17:47 UTC, someone started pushing commands through cloud-hosted ScreenConnect panels belonging to managed service providers. Within 90 minutes, at least 288 endpoints across 48 organizations had been fitted with attacker-controlled remote access clients. About a third of them fell in the first ten minutes. That speed is the headline. The mechanism underneath it is more…
On November 11, 2026, a malicious attack began on cloud-hosted ScreenConnect panels managed by service providers. Within 90 minutes, 288 endpoints in 48 organizations were infiltrated with controlled remote access clients. The attack, analyzed by Huntress and reported by BleepingComputer, utilized a default blank password field in an extension called RMM+.
This extension bypassed ScreenConnect's authentication system, allowing unauthorized access to endpoints. The attack used the extension to deliver a malicious toolkit named SCKit, which installed a rogue ScreenConnect client and maintained a connection to the attacker's server. Although the self-propagation mechanism failed to infect other devices, the attack demonstrated the vulnerability of the blank password field and the potential for lateral movement through legitimate ScreenConnect functionality.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
